Subject: Re: [Isis-wg] MD5 Authentication Questions

From: "Suresh Boddapati" <[email-masked]>
Date: Thu, 31 Jan 2002 07:10:09

What is the rationale behind making the checksum zero before computing the 
authentication value and then computing the checksum over the entire packet 
(including the authentication TLV)? Why not just leave it at zero, like OSPF 
MD5 authentication does? If the computation of the authentication value at 
both the sending and receiving ends dont match, isn't that enough to discard 
the packet? On the other hand, if they do match, wont the checksum 
claculation always yield the same result at the sending and receiving end 
thereby making checksum calculation and verification redundant?

Regards,

Suresh

>  | 2)What about the checksum? Is it left at zero since the authentication 
>value
>  | itself can be used as a mechanism to detect packet corruption? In other
>  | words, should the checksum field be always zero for MD5 authenticated
>  | packets? If not, is the checksum computed after adding the 
>authentication
>  | information to the LSP or before?
>
>
>Both values should be restored after computation.
>
>Tony
>_______________________________________________
>Isis-wg mailing list  -  [email-masked]
>http://external.juniper.net/mailman/listinfo/isis-wg

_________________________________________________________________
Send and receive Hotmail on your mobile device: http://mobile.msn.com

_______________________________________________
Isis-wg mailing list  -  [email-masked]
http://external.juniper.net/mailman/listinfo/isis-wg

---

From: Tony Li <[email-masked]>
Date: Wed, 30 Jan 2002 23:48:39 -0800

Not all systems in a domain may support authentication because of migration
issues.  Thus, always providing the checksum is a good thing.

Tony

Suresh Boddapati writes:
 | What is the rationale behind making the checksum zero before computing the 
 | authentication value and then computing the checksum over the entire packet 
 | (including the authentication TLV)? Why not just leave it at zero, like OSPF 
 | MD5 authentication does? If the computation of the authentication value at 
 | both the sending and receiving ends dont match, isn't that enough to discard 
 | the packet? On the other hand, if they do match, wont the checksum 
 | claculation always yield the same result at the sending and receiving end 
 | thereby making checksum calculation and verification redundant?
 | 
 | Regards,
 | 
 | Suresh
 | 
 | >  | 2)What about the checksum? Is it left at zero since the authentication 
 | >value
 | >  | itself can be used as a mechanism to detect packet corruption? In other
 | >  | words, should the checksum field be always zero for MD5 authenticated
 | >  | packets? If not, is the checksum computed after adding the 
 | >authentication
 | >  | information to the LSP or before?
 | >
 | >
 | >Both values should be restored after computation.
 | >
 | >Tony
 | >_______________________________________________
 | >Isis-wg mailing list  -  [email-masked]
 | >http://external.juniper.net/mailman/listinfo/isis-wg
 | 
 | 
 | 
 | 
 | _________________________________________________________________
 | Send and receive Hotmail on your mobile device: http://mobile.msn.com
 | 
_______________________________________________
Isis-wg mailing list  -  [email-masked]
http://external.juniper.net/mailman/listinfo/isis-wg